fix(python): prefer field-level pyproject identity fallback

[mstykow]

Summary

• fix pyproject.toml identity precedence so incomplete [project] metadata can fall back per field to [tool.poetry] or legacy top-level metadata instead of suppressing a stronger available identity
• stop treating repository/vcs_url as a fallback download_url, and keep download_url aligned with explicit download links or the synthetic PyPI source tarball
• add targeted regressions for mixed [project] + [tool.poetry] identity fallback and update the existing pyproject golden expectation to reflect the corrected download URL semantics

Scope and exclusions

• Included:
  • src/parsers/python/pyproject.rs field-level precedence for identity-bearing fields and URL fallback tightening
  • src/parsers/python/test.rs regression coverage for mixed-surface identity fallback and repository-vs-download behavior
  • testdata/python/golden/pyproject.toml-expected.json expected output update for corrected download_url
• Explicit exclusions:
  • no broader Python parser architecture changes
  • no changes to setup.py/setup.cfg/metadata precedence outside pyproject.toml

Intentional differences from Python

• Provenant now keeps pyproject identity fields source-coherent across [project], [tool.poetry], and legacy top-level metadata, instead of letting a present-but-incomplete higher-priority table suppress a stronger lower-priority identity.

Expected-output fixture changes

• Files changed: testdata/python/golden/pyproject.toml-expected.json
• Why the new expected output is correct:
  • the fixture has a repository URL but no explicit download URL
  • download_url should describe an artifact download, not the source repository homepage
  • the parser now correctly emits the synthetic PyPI source tarball URL while preserving the repository URL in vcs_url